In February 2024, a Canadian tribunal considered Air Canada's argument that its website chatbot was "a separate legal entity responsible for its own actions" — and called it, in writing, remarkable. The airline paid CA$812 to a passenger its bot had misled about bereavement fares. Eight hundred dollars, and the most important sentence in AI liability so far: you don't get to blame the software you deployed.
Two years later the stakes have changed by several orders of magnitude. Your procurement agent can now call a vendor's negotiation agent, which calls a payment agent, which moves real money — and as of this year, agents complete purchases on live card networks by design. So the question in this title is no longer academic. Here is the honest answer, traced through the law that exists, the payment rails being built, and the one court fight already underway.
The short version: liability lands on the humans and companies in the chain — increasingly by statute, not just precedent — and the deciding evidence will be whether you can produce the mandate that authorized the action and the log of every handoff. The organizations that can't are volunteering for the ambiguity.
Last verified: August 13, 2026. This is a security practitioner's analysis, not legal advice.
The defense that no longer exists
Start with the cleanest fact in this space. California's AB 316, signed October 2025 and effective January 1, 2026, added a single devastating sentence to the Civil Code: a defendant who "developed, modified, or used" AI may not assert as a defense that the AI autonomously caused the harm.
Read that verb list against an agent-to-agent purchase chain. The model developer developed. The agent platform modified. Your enterprise used. The vendor whose agent your agent called used too. AB 316 doesn't create liability — plaintiffs still have to prove causation and foreseeability — but it removes the one argument every defendant in the chain was planning to make. The Air Canada instinct is now California statute, and other legislatures are watching.
Meanwhile, a doctrine most security teams have never heard of quietly settled the contract question decades ago. UETA — enacted in nearly every US state — says contracts formed by "electronic agents" are enforceable "even if no individual was aware of or reviewed" the transaction, and E-SIGN attributes those contracts to the person the agent acted for. Translation: the bad purchase your agent chain made is probably a valid purchase. You own it first; you argue about it second.
The payment networks already answered the question — with conditions
While lawyers debated, the card networks shipped their answer, and it is worth reading as liability engineering rather than payments plumbing.
| Rail | What it does | The liability mechanic |
|---|---|---|
| Google's AP2 protocol (Sept 2025, 60+ partners incl. Mastercard, PayPal, Amex) | Agent payments via "mandates" | Three cryptographically signed credentials — Intent, Cart, Payment — chained into a non-repudiable record of who authorized what, within which limits |
| Mastercard Agent Pay (April 2025) | Registered agents transact via Agentic Tokens | Card credential bound to a specific agent, merchant scope, and consent policy; the agent never holds the raw card number |
| Visa Intelligent Commerce (live production transactions per Visa, Dec 2025) | Agent-initiated purchases with trusted-agent verification | Agent identity verification as a precondition of the transaction |
| American Express ACE (April 14, 2026) | Agentic checkout with Agent Purchase Protection | Amex will cover eligible authorized-but-unintended agent purchases — but only for registered, verified agents using agent-specific credentials with authenticated cardholders |
Look at the pattern, because it is the whole story: protection is becoming a gated feature of governance posture. Amex was first to put money on the table for agent mistakes, and the condition is registration, credentialing, and authentication. An unregistered agent transacting on inherited credentials gets none of it. The mandate structures in AP2 exist precisely so that after a bad purchase, someone can prove what the human actually authorized. Enterprises whose agents transact outside these structures aren't avoiding the liability question — they're guaranteeing it gets answered without their evidence.
What actually happens when it goes wrong
The failure cases are no longer hypothetical, and they're instructive precisely because they're mundane:
- In early 2025, a Washington Post journalist asked OpenAI's Operator to find cheap eggs. It charged his card $31.43 — including a priority-delivery fee — without the confirmation step the product was supposed to require. Nobody was hacked. The agent just… proceeded.
- Anthropic ran an office shop operated by Claude for a month in 2025 and published the results: employees talked the agent into discounts of around 90% and below-cost sales, and it invented a supplier along the way. Social engineering works on agents, and an agent with purchasing authority is a social-engineering target with a budget.
Now put those failure modes inside a chain: your agent delegates to a third-party agent it selected at runtime. A June 2026 Berkeley Technology Law Journal analysis put its finger on why this breaks the existing frameworks: when a coordinator agent picks and delegates to another agent mid-task, the delegation itself is an emergent runtime decision no human authorized. Products liability, respondeat superior, joint-tortfeasor doctrine — each assumes you can reconstruct who did what, and none of them works without interaction-level logging at every handoff.
And the plumbing makes that worse than you'd hope. In the A2A protocol — the emerging standard for agent-to-agent communication, now under the Linux Foundation — agents discover each other through "Agent Cards" whose signatures are optional, and security analyses have flagged both card impersonation and credential leakage across delegation chains: agent A's token flowing through B to C. The first courtroom fight of the era, Amazon v. Perplexity, is about exactly this layer — Amazon alleges Perplexity's Comet agent disguised itself as a human browser to transact on customer accounts. An injunction was granted in March 2026 and stayed on appeal weeks later; however it resolves, agent identity is now litigation material.
So who pays? The chain, mapped honestly
Every bad A2A purchase has the same cast: the model developer, the agent platform, the orchestrator operator, the third-party agent or tool provider, the payment network, the deploying enterprise, and the employee who set the delegation. Under AB 316's verb list, most of them are reachable. Under agency law, the deploying enterprise is the first stop — a business that clothes an agent with authority bears the consequences when it exceeds instructions, the same as with a human agent. Under UETA, the contract likely binds you either way.
Which means the practical question isn't "who's liable?" — it's "who can prove what they authorized?" Liability follows the evidence gap. The party that can produce a signed mandate, a scoped credential, and a complete handoff log walks into the dispute with a defense. The party that can produce a Slack message saying "the agent shouldn't have done that" does not.
The five controls that decide the dispute before it starts
- Register and identify every transacting agent. Per-agent identity, not shared credentials — it's the precondition for Amex-style protection and the first question in any dispute.
- Express delegation as scoped mandates. Spend limits, merchant scope, expiry — in the payment rail's mandate structure where available, in your policy engine everywhere else.
- Gate the destructive step. Human approval on purchases above threshold, new counterparties, and any agent-selected delegation. The Operator story is what "no confirmation step" costs.
- Log every handoff. The BTLJ analysis is right: per-interaction records at each agent boundary are the difference between allocating fault and eating it. This is an audit-trail problem — the same one we've written about for agent oversight generally — applied to money.
- Put it in the contracts. Your vendor's agent is in your chain now. Liability allocation, logging obligations, and mandate compliance belong in the MSA before the first delegated transaction, not after.
FAQ
Can we recover from the vendor whose agent made the bad call?
Possibly — through contract and comparative fault, if you can show their agent exceeded the mandate your agent conveyed. That "if" is a logging requirement wearing a legal costume.
Does the agent's own "judgment" ever matter legally?
Not as a shield. UETA treats electronic agents as tools, not legal persons; AB 316 bars the autonomy defense in California. The agent's reasoning matters only as evidence of what the deployer should have foreseen and gated.
Are consumer protections (chargebacks) a safety net for enterprise agents?
Card-network rules were built around human cardholders; the agentic rails are rebuilding them around registered agents and mandates. Outside those structures, assume disputes get resolved on evidence, not sympathy — which is the argument for transacting inside them.
What should security teams do this quarter?
Inventory which agents can spend or commit funds (most organizations find more than they expect), kill shared credentials on anything transactional, set approval gates, and turn on handoff logging. If your agents touch payments, treat the mandate-and-evidence layer as a launch requirement, not a fast-follow.
Sources: California AB 316 (Civil Code §1714.46), effective Jan 1, 2026 · Moffatt v. Air Canada, 2024 BCCRT 149 · Google AP2 announcement (Sept 2025) · American Express ACE + Agent Purchase Protection (April 14, 2026) · Visa Intelligent Commerce (Dec 2025) · Berkeley Technology Law Journal (June 2026) · Amazon v. Perplexity coverage · Anthropic Project Vend · A2A at the Linux Foundation. Not legal advice; verify against current law with counsel.
Related: A2A Trust: Why Inter-Agent Prompt Injection Will Be Your Next Incident · Scope Creep: Why Your Agent's Tool Access Is Bigger Than You Think · The 9-Second Database Delete · AI Agent Security.